September 2026 CVE archive
Records last modified in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
11,186
Critical
1,210
High
4,308
Medium
4,071
Low
456
Severity not reported
1,141
In CISA KEV
59
Most affected vendors (by CPE data where available): microsoft (945), google (605), oracle (274), apple (244), adobe (197), dell (137), ibm (104), arubanetworks (101), mongodb (64), apache (53)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83177 Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83146 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
high | 7.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83152 Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Su... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83144 Vulnerability in the Siebel Apps - Customer Order Management product of Oracle S... |
high | 8.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83145 Vulnerability in the Siebel Apps - Customer Order Management product of Oracle S... |
high | 8.7 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-83143 Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (c... |
high | 8.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-89180 EFence developed by Thinking Software Technology has a SQL Injection vulnerabili... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-93468 The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-19515 The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate... |
high | 7.0 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-81902 Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block... |
high | 8.1 | — | Concretecms / concrete cms | 2026-09-14 | 2026-09-18 |
| CVE-2026-19781 Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Exec... |
high | 7.8 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-19774 BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. |
high | 7.1 | — | — | 2026-09-15 | 2026-09-18 |
| CVE-2026-85128 The Choose User Role at Registration WordPress plugin before 1.3.3 does not vali... |
high | 7.5 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-85130 The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value su... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-87786 The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinat... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88792 The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitis... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-88904 The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-91014 The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2... |
high | 7.1 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-86801 The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-81810 The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not pe... |
high | 7.2 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85122 The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not vali... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85127 The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does no... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87767 The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87770 The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sani... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87771 The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87774 The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize an... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-87775 The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize an... |
high | 8.6 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-88825 The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape... |
high | 8.8 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-90978 The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on se... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-25687 A race condition in the ZPA tunnel handler of affected versions of Zscaler Clien... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-59569 An improper input validation vulnerability in Zscaler Client Connector on Androi... |
high | 8.1 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-59570 On affected versions of Zscaler client connector, a pre-installed peer app can t... |
high | 7.5 | — | — | 2026-09-14 | 2026-09-18 |
| CVE-2026-92903 Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsa... |
high | 8.2 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-28326 SolarWinds Access Rights Manager was reported to be affected by an unauthenticat... |
high | 8.8 | — | — | 2026-09-17 | 2026-09-18 |
| CVE-2026-40530 An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in... |
high | 8.0 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-40539 An improper certificate validation vulnerability in Email API in Synology DiskSt... |
high | 7.1 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-85469 A flaw was found in quay-builder-qemu. |
high | 8.0 | — | — | 2026-09-16 | 2026-09-18 |
| CVE-2026-86520 Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read ac... |
high | 7.5 | — | — | 2026-09-18 | 2026-09-18 |
| CVE-2026-69513 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-18 |
| CVE-2026-86427 LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph... |
high | 8.8 | — | Librenms / librenms | 2026-09-07 | 2026-09-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.